The Toolchain Wars

A company called Stainless auto-generates the SDKs that let developers talk to AI APIs. Its client list includes OpenAI, Google, Meta, Cloudflare, Runway, and Groq. Its SDKs get downloaded tens of millions of times per week. And according to The Information, Anthropic is in talks to acquire it for upwards of $300 million.¹ If the deal closes, Anthropic will own the tool that builds its competitors' developer interfaces.

This is not an isolated play. Over the past six months, OpenAI and Anthropic have been buying developer infrastructure companies at a pace that makes their model research budgets look restrained. The targets are not AI startups. They are the maintainers of package managers, runtimes, linters, and SDK generators — the plumbing that millions of developers use every day, often without knowing who built it.

The acquisitions follow a logic that has nothing to do with the models themselves. It is vertical integration, executed downward through the stack, from the inference layer to the tools developers use before they ever make an API call.

The SDK Play

Stainless is a roughly 20-person company based in New York. It was founded by Alex Rattray, formerly of Stripe, and it does one thing well: you feed it an API specification, and it generates type-safe, idiomatic SDKs in multiple languages. The company raised $35 million across rounds led by Sequoia and Andreessen Horowitz.²³

Stainless matters because SDK quality determines how developers experience an API. A well-generated SDK with good types, clear error handling, and proper pagination is the difference between a developer choosing your platform and abandoning it after an afternoon. Stainless clients include most of the major AI labs. OpenAI's Python and Node SDKs — the ones that show up in every tutorial, every quickstart guide, every Stack Overflow answer — are Stainless-generated.²

If Anthropic acquires Stainless, it gains direct control over a tool its competitors use to ship their developer experience. Anthropic would not need to sabotage anything. It would just need to prioritize. Every hour of Stainless engineering time spent on Anthropic's SDK roadmap is an hour not spent on OpenAI's. The leverage is structural, not adversarial.

The reported price — north of $300 million for a company that raised $35 million total — reflects that leverage. Anthropic is not paying for Stainless's revenue. It is paying for the dependency graph.

The Package Manager Play

On March 19, 2026, OpenAI announced it was acquiring Astral, the company behind uv, Ruff, and ty.⁴

If you write Python in 2026, you have probably used at least one of these tools. uv is a package and project manager that has been downloaded more than 126 million times per month.⁴ Ruff is a linter and formatter that replaced entire toolchains. ty is a type checker. All three are written in Rust, all three are MIT-licensed, and all three were built by a small team led by Charlie Marsh, who joined OpenAI's Codex team as part of the deal.⁵

OpenAI has more than 2 million weekly Codex users.⁴ Those users write Python. They install packages. They lint code. They resolve dependencies. Every one of those operations now flows through tools that OpenAI owns. The tools remain open source — MIT-licensed, community contributions still accepted — but the company that sets the roadmap, hires the maintainers, and decides what gets built next is now the same company that sells the AI coding assistant.

Simon Willison, the developer and writer who has tracked AI tooling more closely than anyone outside the labs, identified the risk immediately. He called it "a mechanism of open source capture" — not closing the code, but redirecting whose needs the roadmap serves.⁶

"Being acquired by OpenAI means the project's roadmap will be set by OpenAI's priorities, not by the needs of the broader Python community."⁶

Willison also noted that OpenAI has zero track record maintaining acquired open-source projects. This was their first major open-source acquisition. The community was being asked to trust a company that is still losing billions annually to be a responsible steward of critical infrastructure, indefinitely.⁶

The Acquisition Scorecard

Stainless and Astral are not outliers. They are the latest entries in an accelerating pattern of AI companies buying developer tools. Here is the current map:

Anthropic acquired Bun on December 2, 2025 — the same day Claude Code hit $1 billion in annualized revenue. Bun remains MIT-licensed.⁷ Vercept, acquired in February 2026, gave Anthropic the computer-use capabilities that let Claude interact with desktop applications.⁸

OpenAI completed 6 acquisitions in Q1 2026 alone, bringing its total to 17 since 2023.⁹ The broader market hit 266 AI M&A deals in Q1 2026, a 90% year-over-year increase.⁹

The Google-Windsurf deal is instructive in a different way. Google paid roughly $2.4 billion not for a product but for people — Windsurf's CEO and about 40 engineers. Cognition picked up the actual product and IP for around $250 million.¹⁰ When the talent is worth ten times the product, the message is clear: the bottleneck in AI is not software. It is the people who know how to build developer tools that work.

The Capture Mechanism

The standard fear around open-source acquisitions is that the new owner will close the code. That almost never happens. The MIT license makes it legally impossible to revoke, and the PR damage of trying would be catastrophic. What happens instead is subtler and more effective.

The acquiring company hires the core maintainers. The maintainers keep committing. The repo stays open. But the roadmap shifts. Features that serve the acquirer's products get prioritized. Features that serve competitors get deprioritized. Bug reports from the acquirer's internal teams move to the top of the queue. Community PRs that conflict with the acquirer's direction sit unreviewed.

None of this requires malice. It requires only that the maintainers now have a boss, and the boss has a product strategy. The code is open. The governance is closed.

Willison's term for this — open source capture — is precise because it describes the mechanism without overstating the intent. OpenAI did not buy Astral to kill uv. It bought Astral so that uv's development would serve OpenAI's needs first. The Python community's needs would be served second, and only to the extent that they aligned.

The same logic applies to every deal on the scorecard. Anthropic did not buy Bun to close-source JavaScript. It bought Bun so that the JavaScript runtime its own tools depend on would evolve in the direction Anthropic needs. If Stainless closes, Anthropic will own the SDK generator and can ensure that its own SDKs are always the best-generated, the fastest-updated, the first to support new features.

The Oracle Warning

There is a historical parallel worth examining, and it is not a reassuring one.

In 2010, Oracle acquired Sun Microsystems for $7.4 billion. Sun owned Java, MySQL, OpenOffice, Solaris, and Hudson (the CI server). Oracle promised stewardship. What followed was a slow-motion diaspora. James Gosling, the creator of Java, resigned. Tim Bray, who co-invented XML while at Sun, resigned. Kohsuke Kawaguchi forked Hudson into Jenkins and left. Bryan Cantrill left to build Joyent. MySQL was effectively abandoned in favor of Oracle's commercial database, and the community forked it into MariaDB.¹¹

Oracle did not kill any of these projects outright. It just stopped caring about them in the ways their communities needed. The projects that survived did so because the open-source licenses allowed forks. The forks that succeeded did so because enough of the original maintainers left to staff them.

The 2018 Microsoft-GitHub acquisition offers the counter-example. Microsoft paid $7.5 billion, the developer community predicted disaster, and GitHub has arguably improved under Microsoft's ownership. Copilot exists because Microsoft owned GitHub. The platform's infrastructure got better. The free tier got more generous.¹¹

Both outcomes are possible. The difference between the Oracle path and the Microsoft path is not the license or the code. It is whether the acquiring company's incentives remain aligned with the community's needs over time. Microsoft needed GitHub to stay the center of the developer ecosystem. Oracle needed Sun's technologies only to the extent they fed Oracle's enterprise sales machine.

The AI labs are closer to the Oracle model than the Microsoft model. They need developer tools to feed their AI products. The moment a tool's community interest diverges from the acquirer's product interest, the tool's community loses.

The Vertical Stack

Step back and look at what is being assembled. OpenAI now owns the Python package manager that developers use to install libraries, the linter they use to check code, and the type checker they use to catch errors. It also operates the AI coding assistant (Codex) that generates the code in the first place, and the API (GPT) that powers it.

If the Stainless deal closes, Anthropic will own the SDK generator that produces the client libraries developers use to call AI APIs, the JavaScript runtime (Bun) those libraries run on, the desktop automation layer (Vercept) that lets AI agents interact with applications, and the AI model (Claude) and coding tool (Claude Code) that sit on top.

This is vertical integration from the model layer down to the package manager. The AI companies are not just competing on model quality anymore. They are competing on how much of the developer's daily workflow they control. The model is the top of the stack. The toolchain is the bottom. And the bottom is where the lock-in lives.

A developer who uses uv to manage packages, Ruff to lint, Codex to generate code, and GPT to power it is operating entirely within OpenAI's stack. A developer who uses Bun to run JavaScript, Stainless-generated SDKs to call APIs, and Claude Code to write the code is operating entirely within Anthropic's. Neither developer chose this. They chose the best tool for each job, and the acquisitions folded those choices into a single company's portfolio after the fact.

That is the strategy. You do not ask developers to buy into your ecosystem. You buy the ecosystem they already chose.

The Math of Capture

The financial logic is straightforward. Claude Code generates over a billion dollars a year in revenue. A $300 million acquisition of Stainless is less than four months of that revenue. OpenAI's Codex has 2 million weekly users at price points that generate substantial recurring revenue. Buying Astral at whatever undisclosed price was trivial against that base.

The AI labs are the only buyers with both the financial capacity and the strategic motivation to pay these premiums. A developer tools company that might sell to a private equity firm for 5x revenue can sell to an AI lab for 10x or 20x, because the AI lab is not buying revenue. It is buying a position in the developer stack.

This creates a one-way ratchet. Once the AI labs start acquiring toolchain companies, the remaining independent toolchain companies face a choice: sell now at a premium, or compete against tools backed by companies with functionally unlimited capital. The 266 M&A deals in Q1 2026 suggest most are choosing to sell.⁹

What Remains Independent

Not everything has been acquired. npm is owned by GitHub (Microsoft). Cargo belongs to the Rust Foundation. Go's toolchain is Google's. The Linux kernel is governed by the Linux Foundation. These are either too large, too legally entangled, or too community-governed to acquire in the conventional sense.

But the newer, faster-moving tools — the ones written by small teams, backed by venture capital, not yet embedded in foundation governance — are vulnerable. Stainless had 20 employees. Astral was similarly small. Bun was essentially Jarred Sumner plus a handful of contributors. These are companies, not foundations. They have investors who want exits. The AI labs are offering exits.

The pattern will continue until either the AI labs own enough of the stack to stop buying, or the remaining independent projects move to governance structures that make acquisition impossible. Neither outcome is imminent.

The Thesis

The model wars get the headlines. Opus versus GPT versus Gemini, benchmark scores, context windows, reasoning chains. But the model layer is a commodity in formation. Every lab will eventually ship a model that is good enough for most tasks. The differentiation will come from everything around the model — the tools, the integrations, the developer experience, the workflow.

That is what the acquisitions are buying. Not intelligence. Infrastructure. The AI companies have looked at the developer stack and decided that owning the tools is more durable than owning the best model. Models improve on a cadence of months. Developer habits, dependency trees, and toolchain choices persist for years.

OpenAI bought Python's package manager. Anthropic is buying the SDK generator that OpenAI depends on. Both are buying the layer that sits between the developer and the model. Whoever owns that layer owns the developer relationship. And whoever owns the developer relationship owns the platform.

The toolchain wars have started. Most developers have not noticed yet, because the tools still work the same way they did last month. That is the point. The best infrastructure acquisitions are the ones where nothing changes on the surface and everything changes underneath.